Getting Data In

Re-indexing the complete file

NAVEEN_CTS
Path Finder

I have a file that is monitored at the UF . File gets frequently updated (same file). In some occasion , already existing fields might change and in some occasion additional lines will be added either at the bottom , or at any part of the file.

Problem here is, if changes occurring at the beginning or in first few lines....the complete file gets indexed, whereas if the changes occurring at the bottom . (for ex : if 2 additional lines added at bottom) only those 2 lines are indexed.

Requirement:

In whatever the case , if there are changes in the file , i want the file to be completely re-indexed. If this is possible please help me with the steps.

Thanks in Advance

0 Karma

koshyk
Super Champion

The idea is to index the whole file everytime, then the following thread might help you.
https://answers.splunk.com/answers/5426/entire-file-contents-as-a-single-event.html

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...